Interworking gateway for mobile nodes

ABSTRACT

Systems and methods are provided that allow inter-working between communication networks for the delivery of service to mobile nodes. A gateway is provided that communicates with a femto cell to extend service to an area that otherwise does not receive coverage from a service provider. The femto cell is a small scale base station used to provide coverage over a small area (such as a home or business), and connect to a home or enterprise network. The femto cell provides service for a mobile node and a gateway permits communication over a broadband network. The gateway integrates the mobile nodes connecting via a femto cell into the service provider&#39;s network. The gateway also allows provisioning of services and applications, control of service levels, and provides seamless handoffs to marco base stations and other types of access technologies such as Wi-Fi.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of currently pending U.S. patentapplication Ser. No. 12/259,266, entitled “Interworking Gateway forMobile Nodes,” filed Oct. 27, 2008, which claims benefit under 35 U.S.C.§119(e) of U.S. Provisional Patent Application Nos. 61/000,429, entitled“Interworking Gateway For Mobile Nodes,” filed Oct. 25, 2007;61/004,046, entitled “Interworking Gateway For Mobile Nodes,” filed Nov.21, 2007; 61/022,053, entitled “Interworking Gateway For Mobile Nodes,”filed Jan. 18, 2008; 61/032,370, entitled “Interworking Gateway ForMobile Nodes,” filed Feb. 28, 2008; and 61/108,266, entitled“Interworking Gateway For Mobile Nodes,” filed Oct. 24, 2008, each ofwhich is hereby incorporated by reference herein in its entirety.

FIELD OF THE DISCLOSURE

This disclosure relates to a system and method for providinginter-working between communication networks at a gateway.

BACKGROUND

Wireless communication systems and networks are used in connection withmany applications, including, for example, satellite communicationssystems, portable digital assistants (PDAs), laptop computers, andcellular telephones. One significant benefit that users of suchapplications obtain is the ability to connect to a network (e.g., theInternet) as long as the user is within range of such a wirelesscommunication system.

Current wireless communication systems use either, or a combination of,circuit switching and packet switching in order to provide mobile dataservices to a mobile node. A mobile node can be a cell phone, a PDA, aBlackberry, a laptop computer with a wireless card, or any otherwireless device. Generally speaking, with circuit-based approaches,wireless data is carried by a dedicated (and uninterrupted) connectionbetween the sender and recipient of data using a physical switchingpath. Once the direct connection is set-up, it is maintained for as longas the sender and receiver have data to exchange. The establishment ofsuch a direct and dedicated switching path results in a fixed share ofnetwork resources being tied up until the connection is closed. When thephysical connection between the sender and the receiver is no longerdesired, it is torn-down and the network resources are allocated toother users as necessary.

Packet-based approaches, on the other hand, do not permanently assigntransmission resources to a given call, and do not require the set-upand tear-down of physical connections between a sender and receiver ofdata. In general, a data flow in packet-based approaches is“packetized,” where the data is divided into separate segments ofinformation, and each segment receives “header” information that mayprovide, for example, source information, destination information,information regarding the number of bits in the packet, priorityinformation, and security information. The packets are then routed to adestination independently based on the header information. The data flowmay include a number of packets or a single packet.

Among other things mobile node users may be faced with a situation wheretheir mobile node does not receive adequate service in their home orbusiness. For example, a company may provide mobile nodes to itsemployees so that they can receive emails, such as a Blackberry device.However, the coverage provided by the service provider may not beadequate within the building or in certain areas due to cell towercoverage. This is a problem for both the service provider and the userbecause the service provider would like to be able to provide service toits customer, and the user would like to have the service.

SUMMARY OF THE DISCLOSURE

Systems and methods for providing inter-working between communicationnetworks at a gateway are disclosed. In some embodiments, services andapplications are extended over a broadband network to a femto cell toone or more mobile nodes. The gateway can also provide handoffs from afemto cell to a macro base station. In some embodiments, the gatewayprovides for inter-technology handoffs as well as between macro, femto,and enterprise networks.

In some embodiments, a gateway is provided that includes a femto gatewayfunctionality residing in the gateway that communicates with at leastone femto cell and acts as a proxy for each femto cell with which thefemto gateway communicates by aggregating communications from the atleast one femto cell and communicating as proxy with a core network onbehalf of the at least one femto cell, a security gateway functionalityresiding in the gateway that provides a secure connection and tunnelsdifferent protocols over a broadband network between each femto cell andthe gateway, and the proxy of the femto gateway functionalitycommunicates with other radio access network equipment to provide for ahandoff of a mobile node.

In certain embodiments, a method of providing access to a communicationsnetwork includes receiving a communication from a first femto cell toestablish a connectivity to a gateway, establishing a secure connectionfrom the gateway to the first femto cell, wherein the secure connectionprovides a secure connection and tunnels different protocols over abroadband network between each femto cell and the gateway, aggregatingcommunications from the first and a second femto cell at the gateway andcommunicating as proxy with a core network on behalf of the first andsecond femto cell, and communicating with other radio access networkequipment to provide for a handoff of a mobile node.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1, 2, 14, 15, 16, 25, 32, 33, and 35 illustrate femto accessnetworks architectures in accordance with certain embodiments;

FIGS. 3, 4, 26, 27, and 28 illustrate interfaces and various functionsimplemented in network devices in a femto access network architecture inaccordance with certain embodiments;

FIG. 5 illustrates a call flow diagram where a common protocol providesprotocol independent communication in accordance with certainembodiments;

FIGS. 6, 7, and 13 illustrate a common protocol tunneling setup inaccordance with certain embodiments;

FIG. 8 illustrates a signaling diagram for a simple IP session setup inaccordance with certain embodiments;

FIG. 9 illustrates a signaling diagram for a proxy mobile IP sessionsetup in accordance with certain embodiments;

FIG. 10 illustrates a signaling diagram for a mobile IP session setup inaccordance with certain embodiments;

FIG. 11 illustrates a femto cell to femto cell fast handoff inaccordance with certain embodiments;

FIG. 12 illustrates a femto cell to macro cell fast handoff inaccordance with certain embodiments;

FIG. 17 illustrates call flow from a femto based mobile node to a macrobased mobile node in accordance with some embodiments;

FIG. 18 illustrates call flow from a macro based mobile node to a femtobased mobile node in accordance with some embodiments;

FIG. 19 illustrates a call flow between two femto cell based mobilenodes in accordance with certain embodiments;

FIG. 20 illustrates termination of a call flow between a femto cellbased mobile node and a macro cell based mobile node in accordance withcertain embodiments;

FIG. 21 illustrates signaling is used in femto cell authentication inaccordance with certain embodiments;

FIG. 22 illustrates signaling for mobile node authentication including aglobal challenge and a location update in accordance with certainembodiments;

FIG. 23 illustrates registration of a mobile node through a convergenceserver in accordance with certain embodiments;

FIG. 24 illustrates setup of a voice path through a convergence serverin accordance with some embodiments;

FIG. 29 illustrates femto cell discovery when the femto cell has nostored gateway address and performs a gateway discovery procedure inaccordance with some embodiments;

FIG. 30 illustrates a femto cell registering with a serving gateway inaccordance with certain embodiments;

FIG. 31 illustrates a registration of a mobile node in accordance withcertain embodiments; and

FIG. 34 illustrates another femto based architecture that supportslegacy GSM networks in accordance with certain embodiments.

FIG. 36 illustrates positioning of cards in the chassis in accordancewith some embodiments.

DETAILED DESCRIPTION

Systems and methods are provided that allow inter-working betweencommunication networks for the delivery of service to mobile nodes incertain embodiments. In some embodiments, a gateway is provided thatallows a femto base station or femto cell that is positioned by a userto extend service to an area that otherwise does not receive coveragefrom a service provider. For example, a service provider, such asVerizon Wireless, can sell or give a customer a femto cell for placementin the customer's home to extend service to the mobile node in, forexample, a 50 meter area. The femto cell then can communicate over abroadband connection to a gateway, which can integrate the call into theservice provider's network. The benefits to a customer include reducedcost calls and the attractions of fixed-mobile-convergence (FMC), suchas the convenience of using a single device. The benefits to a serviceprovider include the opportunity to increase average revenue per userand increase network capacity while reducing expenses by movingcommunication flows from expensive outdoor macrocells to cheaperdomestic systems, dropping the need for new macrocell equipment andreducing the demand for backhaul and power.

Femto based telephony systems provide for mobile phone service over avery short distance. A femto cell provides an air interface for mobilenodes and transmission of this information over a broadband connection.A femto gateway (FGW) or femto network gateway (FNG), which areimplemented in a gateway, communicates with one or more femto cells andprovides access to the service provider's network. The femto gateway canallow the femto cell to be a simple device to lower the cost ofmanufacturing the unit. In some embodiments, the femto gateway acts onbehalf of the femto cell to reduce the number of capabilities the femtocell might otherwise need to perform. For example, the femto gateway cancreate a logical packet control function (PCF) to exchange signalmessaging with another PCF in the network to allow for a handoff. Thefemto gateway can also act like an access network (AN) or base stationcontroller (BSC), for example, to provide information to allow handoffsor other network signaling.

The femto gateway can also provide a connection to the femto cell thatallows the femto cell to provide different air interfaces, for example,UMTS, GSM, and CDMA2000, while communications between the femto gatewayand the femto cell are in a common protocol. This feature allows thedevelopment of femto cells that can switch air interfaces as asubscriber switches from a service provider that supports UMTS to aservice provider that supports CDMA2000. A multiple access technologyfemto cell can also provide service to more than one device. Forexample, in a family if the father has a business phone that was withone service provider and a personal phone that was with another serviceprovider. The femto cell could inter-operate with more than one carrier,in some embodiments.

The femto gateway supports existing 2nd generation (2G) and 3rdgeneration (3G) mobile nodes such as GSM, W-CDMA, UMTS, CDMA 2000, andWiMAX as well as emerging mobile node technologies and 2G/3G dual modemobile nodes. The femto gateway also supports a number of handoffs andhandover situations. For example, in the same micro and macro radioaccess network (RAN) transitions from and to femto cell/macro GSM, femtocell/macro W-CDMA, femto cell/macro CDMA 2000, and femto cell/femtocell. Another example of the mobility provided by a femto gateway is atransition to/from a CDMA femto cell and WiMAX macro or a W-CDMA femtocell and GSM macro. The femto gateway provides service coverage andconsistency in voice and packet data, for example, in a transitionto/from existing macrocellular services and femto cell RAN. The femtogateway can also provide local routing of data, in some embodiments, toavoid any delays that might be caused by backhaul links.

The femto gateway can provide timing and frequency synchronization inthe femto cell RAN and the core network. New femto cell specificservices are provided by the femto gateway. These services can includefriends and family usage, sharing femto zone with friends and family,providing closed user group in a femtozone, local data/media accesswithin a single femtozone, access to femtozone local data/media from amacro RAN, and providing data/media access between femtozones ofsingle/multiple operators. The femto gateway, in some embodiments, byvirtue of its setup can reduce the complexity of the femto cell withwhich the femto gateway communicates. This allows the femto gateway toprovide a femto cell that works with automatic discovery of the femtogateway and automatic or minimal configuration of the femto accesspoint. The femto gateway can also perform statistics gathering,optimizations, and software upgrades.

The femto gateway can also recognize the femto cell as a distinctnetwork entity for the purposes of charging or assigning a differentrate structure and works with pre-paid tariffs, post paid tariffs, andprovides ITC for charging purposes. Various quality of service (QoS)features are provided by the femto gateway. The femto gateway canprovide performance targets and measurements of the service provided aswell as signaling and bearer separation and assurance. QoS relating tolink layer mechanisms and mapped to IP layer can be provided. Also QoEor quality of experience can be provided over an unmanaged FBI (feedbackinformation) mechanism. Security features such as signaling and bearerencryption are provided by the femto gateway. Access authorization andmutual authentication between the network and the femto cell can beprovided. The femto gateway can allow service authorization for usersincluding friends and family access control lists, denial of serviceprevention, and location management of a femto cell. The locationmanagement can be tied to a macro cell, a radio access identifier (RAI),a location access identifier (LAI), or a cell global identification(CGI).

The femto gateway allows session management in a femtozone. This can beprovided by policies that dictate, for example, whether to drop calls orallow best effort. The policies can be based on the time-of-day,day-of-week, or other periodic points for access. There can be a localbreakout of voice, an internet offload, and differentiation of policyapplication depending on the type of traffic. In some embodiments theplacement of nodes in the operator's public land mobile network (PLMN)can be with aggregation and IP-peering and/or co-location of variousnodes. The femto gateway also provides support for enterpriseapplications. This can include allowing multiple femto cell operators,each with subscribers in a given location and each operator using aseparate path through a broadband connection to their services domain.The femto cell can also be deployed in a number of coverage types withthe femto gateway. For example, in indoor settings at residences and/orbusinesses in single and multi-tenant deployments as well as inindustrial settings. In outdoor settings, the coverage types can beprivate or public, for example. Collapsed radio arbitration andconnection management selection can be provided for collapsed femto andWiFi cells in some embodiments. In customer premise equipment (CPE),contention policies between femto and WiFi for the broadband link can beprovided. In certain embodiments, discrimination and optimization forQoS can be provided in mobile operator peering to broadband backhaulservice.

The femto gateway can be configured to meet country specificregulations/standards such as lawful intercept, health (e.g., ERP offemto cells), interference at national borders, emergency service withlocation verification. In some embodiments, the femto gateway usesexisting signaling and functions, and extends them to a femto cell toprovide backwards compatibility and broad support for devices, forexample. The femto gateway supports a wide range of multimedia and dataservices and can be agnostic to radio technologies in providingservices. For example, code division multiple access (CDMA), CDMA2000,evolution data only (EVDO), global system for mobile communications(GSM), universal mobile telecommunications system (UMTS), long termevolution (LTE), WiMAX, wireless local area network (WLAN), iBurst,HIPERMAN, and WiBro can be supported by the femto gateway. The UMTSsupported can include E-UTRAN (evolved UMTS terrestrial radio accessnetwork), HSDPA (high-speed downlink packet access), HSUPA (high-speeduplink packet access), Evolved HSPA, and UMTS-TDD (UMTS time divisionduplexing). The femto gateway can also be agnostic to the core network(CN) and can support 2G network switching subsystem (NSS), UMTS CN, CDMACN, and common IMS CN for example. The femto gateway also providesinterworking between different technologies and core networks. Thisallows operators to minimize core network changes and can minimize thecomplexity of femto cells or femto access points deployed.

A femto cell or femto access point is a home BTS, nodeB or an e-nodeB,in some embodiments. Combined with gateway supporting femtofunctionality, it acts as a BSS/RNC for micro cellular environment. ForCDMA2000, the combination acts as a PCF. The gateway also provides aproxy functionality that when acting like a RNC, for example, hides thefemto cell from the core network and handles the processing to removecomplexity from the core network having to communicate with many femtocells. Where applicable the gateway also provides seamless mobilitybetween macro and femto cellular network. A femto cell connects to thegateway over a Fixed Broadband transport using a security associationwith the gateway. The security association between the femto cell andgateway is based on IPSec. IKEv2 is used as an IPSec protocol. In someembodiments, all the user plane and management plane traffic between thefemto cell and the gateway is encrypted and integrity protected. Thegateway creates a security association with the femto cell to provide asecure transport of signaling, bearer and management plane traffic. Thegateway also provides a radio access network (RAN) aggregation functionby including a signaling concentrator function. The signalingconcentrator abstracts all the femto cells as a single radio networkcontroller (RNC) to the public land mobile network core network (PLMNCN). The Femto Gateway may implement a policy and charging enforcementfunction (PCEF) to provide policy and charging control of subscriberservice data flows. The gateway also provides authorized QoS to theflows. The gateway gets the policy and charging control (PCC) rules froma policy and charging rules function (PCRF).

FIG. 1 illustrates a femto access network (FAN) in accordance with someembodiments. As shown, a femto access point (FAP) or femto cell 114 isplaced in a home or other structure 112. The femto access point 114 canprovide the functionality of a base transceiver station (BTS), a basestation controller (BSC), a nodeB, and/or an eNodeB in certainembodiments. The Femto access point 114 can also broadcast to mobilenode 110 in a variety of licensed and unlincensed wireless spectrum andemploying radio frequency (RF) technologies such as code divisionmultiple access (CDMA), CDMA2000, universal mobile telecommunicationssystem (UMTS), long term evolution (LTE), global system for mobilecommunications (GSM), iBurst, HIPERMAN, WiMAX, WiBro, and Wi-Fi. In someembodiments, Femto access point supports more than one RF technology forvarious mobile nodes, for example, CDMA and Wi-Fi. The Femto accesspoint 114 can connect to a broadband network 116 to transmit datareceived from one or more mobile nodes. Broadband network 116 can be acable network, a digital subscriber line, satellite based service, andfiber optic based service. Broadband network 116 provides communicationbetween Femto access point 114 and gateway 118. Gateway 118, which isfurther described below, provides interworking between the communicationnetworks and allow extension of services to mobile node 110. In someembodiments, gateway 118 includes a femto gateway functionality.

Gateway 118 can be deployed in a service provider's network to implementa femto gateway and provide communication to one or more femto cells.The femto cells can be located in a home network or an enterprisenetwork (e.g., a private branch exchange). Gateway 118 establishessecure Internet Protocol (IP) sessions to femto cell or femto accesspoint 114. This secure session can be using IP security (IPsec)ESP/IKEv2 or any other applicable security mechanism. The sessionprovided to mobile node 110 can include voice over IP (VoIP), videoapplications and services, gaming services, email, web services,location based services, music services, as well as other data and videoapplications and services.

Gateway 118 can also provide inter-working between a femto cell and aservice provider's network. This can include bridging or extendingservice over another network through protocols not commonly used by theservice provider. For example, gateway 118 can receive data through anIPsec session and communicate the data in protocols used in the serviceprovider's network. Gateway 118 utilizes both bearer-based protocols andsession-based protocols to route and process sessions received from thefemto cell. The bearer-based protocols and session-based protocols canbe based on service provider configured service policies. Servicepolicies such as Quality of Service (QoS) can be extended over to thefemto cell and can remain intact in a handoff to a service provider basestation. In other embodiments, different service policies can beassigned to femto cell for a mobile node, such as higher levels of QoSthan with a service provider base station. The femto cell can alsocontrol service level agreements (SLA) set by the service provider togovern the session(s) running on gateway 118.

In some embodiments, the gateway 118 provides secure and seamless mobileaccess to a mobile node that connects to the service provider's networkvia gateway 118. Gateway 118 uses both session-based protocols andbearer-based protocols to route and process session based data andservices. The bearer-based protocols can be used to manage bearertraffic which can include data, video, and voice. The bearer-basedprotocols include real time protocol (RTP), file transfer protocol(FTP), and hypertext markup language (HTML). Session-based protocolsinclude session initiation protocol (SIP), hypertext protocol (HTTP),and real time streaming protocol (RTSP).

The femto access network includes femto access points (FAP) 114 and ahome gateway 120 in two structures 112. The femto access point 114 canbe used to communicate with one or more mobile nodes 110 using radiofrequencies and with a home gateway using wireline or wirelesscommunications. In some embodiments, the femto access point 114 and thehome gateway can be implemented in a single device. The home gateway 120can be implemented as a cable modem, a digital subscriber line (DSL)modem, a router, a wireless router, a switch, a voice over IP (VoIP)analog telephony adapter (ATA), or a wireless access point. The homegateway 120 provides means of communicating between networks, and cancommunicate with an access node 122 in a fixed broadband interconnect(broadband network) 116. The access node 122 can be a broadband remoteaccess server (BRAS) or a cable modem termination system (CMTS), forexample. The fixed broadband interconnect 116 may also include amulti-protocol label switching (MPLS) provider edge (PE) router 124 andan Internet Protocol (IP) edge router 126. The gateway 118 communicateswith the fixed broadband interconnect 116 as well as the private landmobile network (PLMN) core 128 in some embodiments as shown in FIG. 1.The PLMN core 128 can include a circuit switching domain 130, a packetswitched domain 132, and an IP multimedia subsystem (IMS) domain 134.The femto gateway in gateway 118 can provide interworking between femtoaccess network and the PLMN core.

FIG. 2 illustrates a femto based service in accordance with certainembodiments. The network of FIG. 2 includes a femto cell or femto accesspoint 114, a broadband backbone 152, an internet backbone provider 154,a gateway 118, a mobile operator IP core 156, and next generationnetwork (NGN) soft mobile switching center (MSC) core or IMS corenetwork 158. As shown, the broadband network can be provided by adifferent service provider than the mobile operator. Additionally, thefemto cell can be implemented as a device that connects to the broadbandbackbone 152 and communicates with gateway 118. The broadband backbone152 can be any type of wide area network (WAN), and can be incommunication with the internet backbone 154, in some embodiments. Thefemto gateway in gateway 118 can provide one or more of the followingfunctionalities: terminate an IP security (IPsec) tunnel from the femtocell 114, convert A1p signaling to session initiation protocol (SIP) andforward the data to a convergence server (not shown), forward CDMA datasession packet flows to the packet core, forward A2p/RTP to the voicenetwork (e.g., media gateway), offload Internet data sessions, andprovide call localization for femto-to-femto sessions. The calllocalization feature can involve bridging a voice call session at thegateway 118 to remove the backhaul link when the gateway is handling acall session from a first mobile node in its coverage area to a secondmobile node in its coverage area. The call localization feature isfurther explained in the published application US 2007025337, which ishereby incorporated by reference herein in its entirety. The femto cell114 provides one or more of the following functions: establishes anIPsec tunnel to the femto gateway, supports one or more simultaneousmobile node sessions to the femto gateway, and provides remotemanagement and configuration by the gateway 118 or another networkdevice.

FIG. 3 illustrates interfaces in a baseline femto architecture inaccordance with certain embodiments. FIG. 3 includes a mobile node 110,a femto access point or femto cell 114, a home gateway 120, a fixedbroadband interconnect 116, a femto gateway 118, a home public landmobile network (HPLMN) radio access network (RAN) 174, a HPLMN corenetwork 176, and a femto management system 178. The HPLMN is the networkin which the subscriber's profile is stored and mobility functionalitycan be provided through the HPLMN. The HPLMN core network includessubscriber databases 180, a circuit switched (CS) core (circuit/ATMbased) 182, a circuit switched core (ip based) 184, a packet switched(PS) core 186, and an IP multimedia subsystem (IMS) core 188. The femtomanagement system can include a femto access point-management system(FAP-MS) 196 function and a femto gateway-management system (FGW-MS)198. The femto management system may be implemented in a servercomputer, a Starent ST16 or ST40 intelligent mobile gateway, or anyother applicable device.

The femto gateway includes a security gateway (SeGW) function 190, asignaling transport converter (STC) 192, a bearer transport converter(BTC) 192, and a signaling interworking function (IWF) 194. The securitygateway 190 can communicate between various security protocols and canprovide a tunnel endpoint for security protocols and securecommunications between the femto access point and the HPLMN. Thesignaling transport converter 192 can convert from one signalingprotocol to a second signaling protocol, e.g., lu (an interface from theradio network core to the core network) to ip and lu to ATM(asynchronous transfer mode). The bearer transport converter can convertfrom one bearer protocol to a second bearer protocol, e.g., from VoIP tovoice over time-division multiplexing (VoTDM) or VoIP to voice overasynchronous transfer mode (VoATM). The interworking function 194provides a signaling interworking function that provides translation andcommunication between different network entities. For example, betweenthe radio access network application part (RANAP) used in UMTS signalingto IMS-SIP. The RANAP resides in the control plane of the radio networklayer of the lu interance in the UMTS protocol stack, while IMS residesin the control plane of the core network and can communicate in a SIPvariant. In some embodiments, the transport converters change how theunderlying data is carried through the network without modifying theunderlying data, while the interworking function translates thesubstantive content of the underlying data or message from a first typeor format to a second type or format. The femto gateway can provideinterworking among a number of signals and protocols and can include aproxy to enable interworking among and between protocols.

FIG. 3 also illustrates various types of signaling that can be used in avariety of embodiments. The reference point mappings include: Fa,Fb-CS-1, Fb-CS-2, Fb-PS, Fb-PS, Fb-IMS, Fr, Fl, Fm, and Ut. Fa can be,for example, 1) IOS A type signaling/internet protocol for use with1xCDMA and high rate packet data (HRPD); 2) A/IP signaling for use withglobal system for mobile communications (GSM), and 3) lu/IP signalingfor use with universal mobile telephone system (UMTS). Fb-CS-1 can be,for example, 1) A1,A2 over SS7 (TDM) for CDMA, 2) lu over ATM for UMTS,3) A over SS7 (TDMt) for GSM. Fb-CS-2 can be, for example, A1p, A2p overIP to a softswitch (MSCe) and media gateway (MGW) in a CDMA2000implementation, 2) lu over IP to MSC server and CS-MGW (circuitswitched-media gateway) in a UMTS implementation, and 3) A over IP toMSC in a GSM core network implementation. Fb-PS can be, for example, 1)mobile IP (MIP) for HRPD, 2) lu-PS for UMTS/GPRS, 3) S2a/S2b based on atrust model, 4) Gn for UMTS/GPRS for a collapsed SGSN function, and 5)SIP to a convergence server. Fb-IMS can be, for example, Gm basedsignaling. Fr can be, for example, A12 signaling for HRPD with an accessnode authorization, 2) Wm/Wx signaling for UMTS and RADIUS for CDMAimplementations. Fl can be, for example, universal plug and play (UPnP)signaling. Fm can be, for example, TR-069 signaling (broadband formspecification to define an application layer protocol for remotemanagement of end-user devices). Ut can be, for example, HTTP (hypertexttransfer protocol) signaling.

FIG. 4 illustrates a femto architecture with mobility in accordance withcertain embodiments. FIG. 4 includes a mobile nodes 110 a and 110 b,femto access points 114 a and 114 b, home gateways 120 a and 120 b, afixed broadband interconnect 116, a femto gateway 118, a femtomanagement system 178, the internet 210, a HPLMN RAN 174, and a HPLMNcore network 176. The HPLMN core network 176 includes a policy controlresource function (PCRF) 212, subscriber databases 180, a circuitswitched (CS) core 214 (e.g., IP, ATM, and/or circuit based), a PS core186, and an IMS core 188. FIG. 4 shows the signaling that can be usedwhen mobile nodes 110 roam in various embodiments. The reference pointmappings include: Fa, Fd, Ff, Fw, Fi, Fp, and Fe. Fd can be, forexample, CDMA2000, WCDMA, WiMAX, LTE, UMTS, EVDO, WiFi (radio layers),CS over WiFi (signaling), and Uu (a radio interface). Ff can be, forexample, signaling for intra femto access node mobility such as lur orA3/A7 relayed via the femto gateway. Fw can be, for example, inter femtoaccess node/macro cellular network mobility and use signaling such aslur or A3/A7. Fi can be signaling for a packet data interface to theinternet such as Gi. Fp can be a policy interface such as Gx or Tydepending on the deployment. Fe can be a policy or QoS control interfaceto the access network such as Rq. The user control plane for the Fareference point for circuit switched (CS) services maps to A1p forCDMA2000, for UMTS it maps to Iu-CS, and for LTE it maps to S1-U &S1-MME. The user data plane for CS services for CDMA2000 maps to A2p.The user control plane for packet services for CDMA2000 maps to A11while data plane for CDMA2000 maps to A10. For UMTS PS services the Fainterface maps to Iu-PS.

FIG. 5 illustrates a call flow diagram where a common protocol providesprotocol independent communication in accordance with certainembodiments. FIG. 5 includes a mobile node 110, a femto cell 114, and afemto network gateway 118. Femto cell 114, in some embodiments, usestunnels such as internet key exchange (IKE) and internet protocolsecurity (IPSec) to send and receive information with femto networkgateway 118, which can provide for protocol independent communication.An IKEv2 security association (SA) 216 can be used to authenticate femtocell 114 and allow the setup of one or more IPSec security associations(such as Base IPSec 218 and Data IPSec 220). Depending on theembodiment, a single IPSec SA can be used, or multiple IPSec SAs can beused. Using multiple IPSec SA allows for differentiated quality ofservice (QoS) for each mobile node. As shown, IKEv2Informational-Notify-Status messaging 222 can be used to exchangeinformation to setup a session for mobile node 110. When an attachrequest 224 is received from a mobile node, femto cell 114 can send anIKEv2 222 message to femto network gateway 118. A point to pointprotocol (PPP) session 226 is setup between mobile node 110 and femtogateway 118, which can involve authentication of the mobile node andassignment of an IP address. The femto network gateway 118 can initiatea child security association 228 to provide an additional secure tunnel.Data 230, which can include voice and other information, then flows fromthe mobile node 110 to the femto network gateway 118 for routing and/orprocessing.

FIG. 6 illustrates how packet flows can be handled where multipletunnels and a common protocol is used with the femto network gateway. Asshown, mobile nodes based on different air interface technologies may beused, and mobile nodes with different capabilities can be used. Voicecapable mobile nodes 250 send voice data over an air interface to femtocell 114. This voice data can be sent in TDM (time division multiplex)using a CDMA (code division multiple access) air interface technology.Mobile nodes 252 send both PPP/mobile IP (MIP) signaling and datapackets to femto cell 114 over an evolution data only air interface.Although not shown, other air interface technologies such as UMTS, LTE,WiMAX, WiFi, and GSM can be used along with the attendant signalingprotocols of each air interface technologies. The use of a commonprotocol, which can handle different air interface technologies andprotocols for mobile communications, provides flexibility for the femtocell, while still maintaining secure communications.

More than one tunnel can be setup between femto cell 114 and femtonetwork gateway 118. For example, an IKEv2 tunnel 256 can be setup toallow for key exchange and exchange of information, such as setup orregistration information. A base IPSec SA 258 can be used to communicatePPP/MIP signaling from mobile nodes 252 to PPP/MIP signaling module 254.Femto cell 114 can also communicate commands and other informationregarding handoffs and other events through base IPSec tunnel 258. Voicedata, which may be packetized voice, but not voice over IP (VoIP) frommobile nodes 250 can be communicated over a voice IPSec tunnel 260. Thevoice data can be converted to VoIP on femto network gateway 118 or sentto another server for conversion. The voice data can also be processedfor sending using protocols other than VoIP. Packet data can also becommunicated over one or more data IPSec tunnels such as 262 and 264.

In some embodiments, one IPSec SA can be used to communicate a varietyof information. Generic routing encapsulation (GRE) can be used tocreate multiple tunnels within the IPSec SA so that more than one typeof data from more than one mobile node can be communicated using theIPSec SA. In some embodiments, a GRE key can be used to different amongthe packet flows and to direct the packets to the mobile node at thefemto cell or the function at the femto gateway. FIG. 7 illustrates a1xRTT mobile node 280 (where 1xRTT is a CDMA wireless technology) and anEVDO mobile node 282 in communication with a femto cell 114 and a femtonetwork gateway 118 in accordance with certain embodiments. An IKEv2 SA284 can be used to exchange information such as security keys and can beused to setup an IPSec SA 286. As shown, multiple packet flows arecommunicated within IPSec SA 286. Femto network gateway 118 can usehardware and software to direct these packet flows. For example, a hashcan be setup in a network processor in femto network gateway 118 so thatwhen a packet including certain criteria or information passes throughthe hash it is directed to a particular piece of software orapplication. Other packets can be directed using a software modulecalled a demux manager. The demux manager can be used to determine howto pass along the packet(s). Other software and hardware functions canbe implemented in femto network gateway, in certain embodiments.

Gateway 118, which can include femto gateway functionality, can furtherimplement a PPP/MIP signaling functionality 254, a voice applicationfunctionality 290, a data path 292, and an A-interface proxy andmanagement 294. The PPP/MIP signaling functionality 254 manages a pointto point protocol link between mobile node 282 and gateway 118 and theforwarding MIP signaling to the home agent. The PPP/MIP signalingfunctionality can also setup and teardown sessions with mobile node 282and perform any processing necessary on the data. The voice application290 can handle voice calls, for example, voice sent from the mobile inTDM including the setup of call and the teardown of the call. The datapath 292 can handle data sessions such as email content, VoIP, websurfing, or any other content delivery. The data path can forward thedata on towards its destination and manage the providing of services orprocessing of the data. The services can include services providedinline on the gateway. Additional information regarding providing inlineservices on a gateway is provided in published application Ser. No.11/942,446, which is hereby incorporated by reference herein in itsentirety. If call localization is implemented on gateway 118, then thevarious functionalities communicate with a database on the gateway. Thisdatabase includes information about the sessions and if the gatewaydetects that at least the call sessions of two mobile nodes are passingthrough the gateway, it will perform any necessary processing on thecall session and bridge the sessions removing the backhaul link.

The A-interfaces proxy and management 294 is a function thatcommunicates with a management function 288 on femto cell 114. The proxyfunctionality allows the femto gateway to hide one or more femto cellsfrom the core network. The gateway 118 communicates with the corenetwork as if it was a single radio access network (RAN) and can forwardall the signaling and data flows onto the core network in a singleprotocol or a set of protocols used with a single radio access network.This reduces the complexity of having the core network recognize anumber of femto cells at the edge of the network and further reduces thecomplexity necessary to implement the femto cell. The femto cell can bemanaged by management function 288, which is in communication with proxyand management function 294 on gateway 118.

FIG. 8 is a diagram illustrating simple IP signaling for a mobile nodethat desires to setup a session in accordance with certain embodiments.FIG. 8 includes a mobile node 310, a femto cell 114, a gateway providinga femto gateway 118, an authentication, authorization, and accounting(AAA) server 312, and a home agent (HA) 314. First, the femto cell 114can perform a DNS lookup to get an IP address of femto gateway 118. AnIKE initialization request 316 is sent from femto cell 114 to femtogateway 118 to setup an IKE security association. The IKE initializationrequest 316 includes information used by femto gateway 118 to setup theassociation. An IKE initialization response 318 is sent from femtogateway 118 to femto cell 114 to provide information and allow for a IKESA 320 to be setup. An optional step 322 is to authenticate femto cell114 with AAA 312. At 324, femto gateway 118 allocates a tunnel internaladdress (TIA) and an IPSec tunnel is setup 326. A data call or sessionsetup 328 is initiated between mobile node 310 and femto cell 114. Femtocell 114 sends an A11 registration request 330 and receives aregistration reply 332 to setup a PPP-link control protocol (LCP) 334.At this time, in certain embodiments, femto cell 114 is acting like aPCF and FNG 118 is acting like PDSN for the A11 interface messaging. PPPauthentication 336 signaling includes password authentication protocol(PAP) and challenge-handshake authentication protocol (CHAP).Radius/Diameter authentication 338 can occur between FNG 118 and AAA 312to authenticate mobile node 310. PPP-internet protocol control protocol(IPCP) 340 can be used to configure, enable and disable internetprotocol (IP) elements on the ends of a PPP link. In 342, an IP addressis assigned to the mobile node 310.

FIG. 9 is a diagram illustrating proxy mobile IP (PMIP) signaling for amobile node that desires to setup a session in accordance with certainembodiments. FIG. 9 includes a mobile node 310, a femto cell 114, agateway providing a femto gateway 118, an authentication, authorization,and accounting (AAA) server 312, and a home agent (HA) 314. Femtogateway 118 can implement a PMIP foreign agent (FA) for the purposes ofsignaling and communication in the network. As shown, some of thesignaling was explained in conjunction with FIG. 8. Mobile node 310sends a PPP IPCP configuration request message 350 to PMIP user 352within gateway 118. A mobile IP registration request 354 is sent to HA314 and HA 314 assigns an IP address in step 356 to mobile node 310. Theassigned IP address can be communicated in a MIP registration reply 358.PPP IPCP signaling 360 negotiates the IP address assigned by HA 314, toprovide mobile node 310 with an IP address.

FIG. 10 is a diagram illustrating mobile IP (MIP) signaling for a mobilenode that desires to setup a session in accordance with certainembodiments. FIG. 10 includes a mobile node 310, a femto cell 114, agateway providing a femto gateway 118, an authentication, authorization,and accounting (AAA) server 312, and a home agent (HA) 314. As shown,some of the signaling was explained in conjunction with FIG. 8.Signaling 370 can be performed to obtain an IP address for mobile node310 from HA 314.

Femto gateway also facilitates fast handoffs, in some embodiments. Thefast handoff can be inter-technology as well as between a macro cell, anano cell, or a femto cell. In some embodiments, for example, in a CDMAembodiment, the femto gateway can act like a packet data serving node(PDSN) to the femto cell and a PPP session terminates at the femtonetwork gateway. This allows the femto gateway to use fast handoffprocedures of a PDSN when there is a handoff. The femto gateway allowshandoffs between femto cells, for example, within an office building formobile nodes such as a Blackberry. Handoffs in other embodiments arealso possible. For example, the femto gateway can act like a packet datanetwork gateway (PDN gateway) or a serving gateway (S-GW) in an evolvedpacket core (EPC).

FIG. 11 is a diagram illustrating a femto cell to femto cell fasthandoff in accordance with certain embodiments. FIG. 11 includes amobile node 310, a femto cell 1 114 a, a femto cell 2 114 b, a gatewayproviding a femto gateway 118, and an authentication, authorization, andaccounting (AAA) server 312. In FIG. 11, IPSec tunnels are alreadyestablished between femto cell 1 114 a and femto gateway 118 with IPSectunnel 390 as well as femto cell 2 114 b and femto gateway 118 withIPSec tunnel 392. A data call or session startup signaling 394 betweenmobile node 310 and femto cell 114 a is used to startup the session orcall. Femto cell 114 a sends an A11 registration request 396 with thephone number, for example, in digits. Femto gateway 118 sends an A11registration reply 398. PPP-LCP signaling 400 can begin between mobilenode 310 and femto gateway 118. PPP authorization signaling 402 alongwith radius/diameter authorization signaling 404 is used to authenticatethe mobile node 310. Femto gateway 118 assigns an IP address to mobilenode 310 at step 406. PPP-IPCP signaling 408 can then establish an IPsession with the IP address, in certain embodiments. The session is upand packet flow over the connection using the IP address in 410. At 412,mobile node 310 ranges into femto cell 2114 b. A data call or sessionsetup 414 is begun between mobile node 310 and femto gateway 118. An A11registration request 416 is sent to femto gateway 118. At 418, femtogateway 118 detects the old session and there is no need to renegotiatePPP. A registration reply 420 is sent to femto cell 114 b providing itwith information for the data session to continue with the same IP in422. Because PPP renegotiation is avoided, call setup latency is greatlyreduced, and the same IP address can be used. This provides a fasthandoff.

FIG. 12 is a diagram illustrating a femto cell to macro cell fasthandoff in accordance with certain embodiments. FIG. 12 includes amobile node 310, a femto cell 114, a macro cell 438, a gateway providinga femto gateway 118, and an authentication, authorization, andaccounting (AAA) server 312. As shown, IPSec tunnel 440 between femtocell 114 and femto gateway 118 as well as IPSec tunnel 442 between macrocell 438 and femto gateway 118 are already setup. A data call or sessionstartup signaling 444 between mobile node 310 and femto cell 114 is usedto startup the session or call. Femto cell 114 sends an A11 registrationrequest 446 with information relating to mobile node 310. Femto gateway118 sends an A11 registration reply 448.

As shown, PPP-LCP signaling 450 begins between mobile node 310 and femtogateway 118. PPP authorization signaling 452 along with radius/diameterauthorization signaling 454 is used to authenticate the mobile node 310.Femto gateway 118 assigns an IP address to mobile node 310 at step 456.PPP-IPCP signaling 458 can then establish an IP session with the IPaddress, in certain embodiments. The session is up and packet flow overthe connection using the IP address in 460. At 462, mobile node 310ranges into macro cell 438. A data call or session setup 464 is begunbetween mobile node 310 and femto gateway 118. An A11 registrationrequest 466 is sent to femto gateway 118. At 468, femto gateway 118detects the old session and there is no need to renegotiate PPP. Aregistration reply 470 is sent to femto cell 438 providing it withinformation for the data session to continue with the same IP in 472. Afast handoff is provided as the same IP address is maintained and PPPparameters do not need to be renegotiated, in some embodiments.

In some embodiments, for a handoff, the femto cell acts like a PCF andthe femto gateway acts like a PDSN. PPP renegotiation can be the mosttime consuming because of the authentication that takes place and theother messaging involved with setting up a PPP session. When terminatingin the core, rather than at the edge, more handoffs will be with thesame PDSN (or femto gateway) so this can reduce the number of setupsteps the might otherwise need to occur in renegotiation, causing delay.The femto gateway can receive raw voice (simply packetized voice) andconvert for session initiation protocol (SIP) or real-time transportprotocol (RTP). Voice getting converted in the femto gateway allows fora simpler routing to a traditional network, in some embodiments.

In certain embodiments, the femto gateway simulates other networkelements to act as a proxy for the femto cell. This can allow the femtogateway to hide one or more femto cells from the network and allow thefemto cell to be a simpler device. The femto cell can send the femtogateway commands and other information, for example, a simplifiedcommand set and the femto gateway can use that information to simulate alogical component to communicate with other network elements. Providinga femto gateway that proxies commands for a number of femto cells alsoallows for scalability on the service provider's network. Exposing thefemto cells to the network would not likely scale well in the networkbecause there is likely to be many femto cells given each femto cell'ssmall coverage area relative to a macro cell's coverage area. By havingthe femto gateway proxy commands this allows for scalability to deploy anumber of femto cells in the network. For example, a femto gateway canproxy as a PCF and communicate with a real PCF. The real PCF would notknow that the femto gateway was proxying as a PCF, but only a single IPaddress can be exposed to the network. The femto gateway can also proxyas an enhanced NodeB (eNB), a nodeB, a radio network controller (RNC),an evolved-UMTS terrestrial radio access network (E-UTRAN), a basetransceiver station (BTS), and a base station controller (BSC).

FIG. 13 is a diagram illustrating how some of the proxy functions mightlook in a gateway providing a femto gateway function, in accordance withcertain embodiments. FIG. 13 includes 1xRTT mobile node 110 a, 1xRTTmobile node 110 b, a high rate packet data (HRPD) mobile node 110 c, aHRPD mobile node 110 d, a femto cell 114, and a femto network gatewayfunction 500. As shown, interoperability specification (IOS) basedsignaling can be used for each mobile node through an IPSec tunnel. Eachmobile node can use one or more tunnels within IPSec 502. These one ormore tunnels within map to the mobile node at the femto cell 114 androute the messaging to the function in the femto gateway function 500.For example, A10/A11 is mapped to a PDSN data function 504 which handlesdata and to a PDSN signaling function 506 to handle information from themobile nodes. An A-interface proxy 508 can be used to communicate withother network elements such as a PCF or an AN. A-interface proxy 508 canact like an abstraction for the other A-interfaces that do not reallyterminate on the femto gateway function and the femto gateway proxies toother network elements. Operations, administrative, maintenance, andprovisioning (OAM&P) 498 can be used to manage and track things going onas well as allow for repairs, upgrades, accounting, and statistics.OAM&P 510 can also provide statistics, accounting, upgrades, and errornotification, but may also be used in conjunction with OAM&P 498 tomanage the proxy aspect of femto cell 114. The OAM&P 510 incommunication with OAM&P 498 can allow for configuration of a femto cell114 when initializing in the network and can provide plug-in-playability of the femto-cell 114. An IOS/SIP gateway function 512 tointerwork IOS signaling to SIP signaling is also provided.

FIG. 14 is a diagram illustrating an IOS model for a femto systemarchitecture in accordance with some embodiments. As shown, in the homenetwork 526, mobile nodes 110 can communicate with a femto cell 114. Thefemto cell 114 can implement one or more of a base station transceiver(BTS), a base station controller (BSC), an eNodeB, and a packet controlfunction (PCF). Communication with a femto network gateway can include anumber of A-interfaces using a IPSec SA 528. The functions shown in FIG.13 are then used to communicate with various network elements, in someembodiments. For example, A-interface proxy 508 communicates with BSC530, AN 532, AN-AAA 534, and a CDMA softswitch center (MSCe) 536. Otherfunctions, such as PDSN data function 504 and PDSN signaling function506 (of FIG. 13) can communicate with network elements such as PDSN/FA538, home agent 540, and core IP network 542.

FIG. 15 is a diagram illustrating a session initiation protocol (SIP)model for a femto system architecture in accordance with someembodiments. In a SIP implementation, mobile nodes that are voice overIP (VoIP) enabled such as mobile node 560 can communicate to femto cell114 in VoIP. Further, IOS/SIP gateway function 512 (FIG. 13) can be usedto communicate with SIP network elements such as a convergence server562. In some embodiments, the VoIP data can be sent over RTP to a mediagateway controller (MGC)/media gateway (MGW) 564. FIG. 15 is a diagramillustrating a internet multimedia subsystem (IMS) model for a femtosystem architecture in accordance with some embodiments. FIG. 16illustrates a IP Multimedia Subsystem (IMS) model for a femto systemarchitecture in accordance with some embodiments. FIG. 16 includes apolicy and charging rule function (PCRF) 570 and a call session controlfunction (CSCF)/border gateway control function (BGCF) 572. In someembodiments, IOS/SIP gateway function 512 (FIG. 13) can be used tocommunicate with CSCF/BGCF 572.

FIG. 17 illustrates a call flow from a femto based mobile node to amacro based mobile node in an IOS/SIP model in accordance with someembodiments. FIG. 17 includes a CDMA capable mobile nodes 110 a and 110b, a femto cell 114, a modem 120, a broadband carrier's IP network 152,an internet peering network 154, a femto gateway 118, a mobile carrier'sIP core 156, a convergence server 562, a media gateway control function(MGCF) and media gateway (MGW) 564, an SS7 network 610, a mediacontroller (MC) 612, a home location register (HLR) 614, a mobileswitching center (MSC)/visitor location registry (VLR) 616, a macronetwork 618, a base station controller (BSC) 530, and a macro radioaccess network (RAN) 620. In call flow part 1, the mobile node sends aorigination message to the femto cell. The femto cell sends an A1pcontent management (CM) service request message to the femto gatewayover a GRE/IPsec tunnel, in call flow part 2. In call flow part 3, thefemto gateway terminates the GRE/IPSec tunnel and converts the A1p CMservice request to a SIP invite request and sends the SIP invite requestto the convergence server. The convergence server terminates the SIPinvite send a SIP invite to the MGCF after checking the supplementaryservice profile of the mobile in call flow part 4. In call flow part 5,the media control function routes the call to a terminating MSC via SS7.The terminating MSC and BSC deliver the call to the mobile node on themacro cellular network in call flow part 6.

FIG. 18 illustrates call flow from a macro based mobile node to a femtobased mobile node in an IOS/SIP model in accordance with someembodiments. FIG. 18 includes CDMA capable mobile node 110 a, a femtocell 114, a modem 120, a broadband carrier's IP network 152, an internetpeering network 154, a gateway including femto gateway functionality118, a mobile carrier's IP core 156, a convergence server 562, a mediagateway control function (MGCF) and media gateway (MGW) 564, an SS7network 610, a mobile switching center (MSC)/VLR 616, a home locationregistrar (HLR) 614, a macro network 618, a base station controller(BSC) 530, a macro radio access network (RAN) 620, and a mobile nodecommunicating with the macro RAN 110 b. In call flow part 1, the mobilenode in the macro network initiates a call to a mobile in the femto cellnetwork. The serving MSC sends a LOCREQ message (location request) tothe HLR in call flow part 2. The HLR sends a ROUTREQ messages (routerequest) to the convergence server in call flow part 3. In call flowpart 4, the convergence server provides a TLDN (top level domain name ortemporary location directory number) to reach the destination mobilenode in the ROUTREG response message. In call flow part 5, the HLR sendsthe TLDN to the serving MSC in the LOCREQ response message. The MSCsends a ISUP (IAM) with the TLDN to the MGCF through the SS7 network incall flow part 6. The MGCF sends a SIP invite message that includes theTDLN to the convergence server in call flow part 7. In call flow part 8,the convergence server replaces the TDLN with a MDN (mobile directorynumber) of the destination mobile and sends the SIP invite message withthe MDN to the femto gateway. In call flow part 9, the femto gatewayconverts the SIP invite to an A1p paging request message and forwardsthe message to the femto cell over a GRE/IPsec tunnel. The femto cellterminates the GRE/IPsec tunnel and A1p paging request message and sendsa page message to the mobile node in the femto network.

FIG. 19 illustrates a call flow between two femto cell based mobilenodes in accordance with certain embodiments. FIG. 19 includes two CDMAcapable mobile nodes 110 a and 110 b, two femto cells 114 a and 114 b,two modems 120 a and 120 b, a broadband carrier's IP network 152, aninternet peering network 154, a gateway including femto gatewayfunctionality 118, a mobile carrier's IP core 156, a convergence server562, and a home location registrar (HLR) 614. In call flow part 1, themobile node sends an origination message to the femto cell. The femtocell sends an A1p CM service request message to the femto gateway over aGRE/IPsec tunnel in call flow part 2. In call flow part 3, the femtogateway terminates the GRE/IPsec tunnel and converts the A1p CM servicerequest to a SIP invite request message and sends the SIP invite messageto the convergence server. The convergence server terminates the SIPinvite message and sends a second SIP invite to the femto gateway afterchecking the supplementary service profile of the mobile node in callflow part 4. The second SIP invite can include information obtained fromthe supplementary service profile of the mobile node. The femto gatewayconverts the SIP invite message to an A1p paging request messages andforwards the message to the second femto cell over a GRE/IPsec tunnel incall flow part 5. In call flow part 6, the femto cell terminates theGRE/IPsec tunnel and A1p paging request message and sends a page messageto the mobile node in the second femto network. In call flow part 7, anRTP voice path is routed locally within the femto gateway between thefemto cells.

FIG. 20 illustrates termination of a call flow between a femto cellbased mobile node and a macro cell based mobile node in accordance withcertain embodiments. FIG. 20 includes CDMA capable mobile node 110 a, afemto cell 114, a modem 120, a broadband carrier's IP network 152, aninternet peering network 156, a gateway including femto gatewayfunctionality 118, a mobile carrier's IP core 152, a convergence server562, and a home location registrar (HLR) 614, a base station controller(BSC) 530, and a mobile node in the macro RAN 110 b. In call flow part1, the mobile node sends an origination message to the femto cell. Thefemto cell sends an A1p CM service request message to the femto gatewayover a GRE/IPsec tunnel in call flow part 2. In call flow part 3, thefemto gateway terminates the GRE/IPsec tunnel and converts the A1p CMservice request to a SIP invite request message and sends the SIP invitemessage to the convergence server. The convergence server terminates theSIP invite message and sends a second SIP invite to the femto gatewayafter checking the supplementary service profile of the mobile node incall flow part 4. The second SIP invite can include information obtainedfrom the supplementary service profile of the mobile node. In call flowpart 5, the femto gateway converts the SIP invite to an A1p pagingrequest message and forwards this message to the BSC supporting A1p. TheBSC sends a page message to the mobile node in the macro RAN in callflow part 6. In call flow part 7, a two-way A2p (RTP) voice path isrouted locally within the femto gateway between the macro network andthe femto cell.

FIGS. 21, 22, and 23 illustrate authentication and registration inaccordance with some embodiments. In this process generally a tunnel issetup, a channel is setup, a location update occurs, SIP registrationoccurs, and authentication/registration notification occurs. In tunnelsetup, the femto cell and the gateway communicate to setup a securetunnel. This secure tunnel can be an IPSec tunnel over a broadbandnetwork. The femto cell communicates with the mobile node to setup achannel between the mobile node and the femto cell. After the channel issetup, the femto cell updates the network about the location of themobile node (and its attachment point to the network). SIP registrationof the mobile node occurs between gateway 118 and convergence server526. Authentication and registration notification communication occursbetween the convergence server 562 and the home location register(HLR)/authentication center (AuC)/home subscriber service (HSS) 614.

FIG. 21 illustrates signaling is used in femto cell authentication inaccordance with certain embodiments. FIG. 21 includes a femto cell (FC)114, an internet 154, a gateway 118, an IPsec tunnel, and anauthentication, authorizing, and accounting (AAA) server 312. Thegateway can include a security gateway function (not shown) that canreceive and transmit messages relating to secure transmissions andauthentication. The femto gateway can communicate with the AAA server312 to provide identifying information that is received from the femtocell 114 to the AAA server 312 to verify and provide the femto cell withkey information from the AAA server to setup a secure tunnel. A femtocell 114 can be plug-in-play capable by performing discovery andobtaining an IP address from the network. In 624, femto cell 114 obtainsan IP address from the network and a domain name server (DNS) address.

The network, including gateway 118 in some embodiments, can providefemto cell 114 with a gateway address for the femto cell 114 to attach.To provide security across an otherwise insecure broadband network,femto cell 114 communicates with gateway 118 to setup a secure tunnel.An internet key exchange (IKE) security association (SA) initializationrequest message 316 can be sent to gateway 118 to setup a securityassociation to secure the broadband network. An IKE SA initializationresponse 318 sent from the gateway 118 to the femto cell 114 can promptthe femto cell to send authentication information to the gateway. Thefemto cell can send an IKE Authentication and configuration requestmessage 628. Gateway 118 in response to message 628 sends a RADIUS orDIAMETER request 630 to AAA server 312. AAA server 312 responds with aRADIUS or DIAMETER response 632 and gateway 118 responds to femto cell114 with IKE authentication and configuration response message 634. Theconfiguration response message 634 can include challenge informationfrom AAA server 312. The femto cell 114 supplies the requestedinformation in IKE authentication and configuration message 636 togateway 118. Gateway 118 sends the information in a RADIUS or DIAMETERmessage 638. AAA server 312 responds with a RADIUS accept or DIAMETERanswer message 640. Gateway sends configuration reply or EAP successmessage 642 to femto cell 114 to inform the femto cell of the successfulsecurity association negotiation. Messaging 644 and 646 is used toexchange information such as a TIA to setup IPSec tunnel 648 betweenfemto cell 114 and gateway 118. Gateway 118 then sends a RADIUS orDIAMETER message 650 to start accounting procedures at AAA server 312and receives a confirmation message 652.

FIG. 22 illustrates signaling for mobile node authentication including aglobal challenge and a location update in accordance with certainembodiments. FIG. 22 includes a mobile node (MN) 110, a femto cell (FC)114, an internet 116, a gateway including a femto gateway (FG) 118, aconvergence server 562, a media gateway control function/media gateway(MGCF/MGW) 564, and a home location register (HLR) 614. Theauthentication and location update is shown in a network architectureusing a convergence server 562 and a gateway 118 to provide interworkingto a SIP protocol. Gateway 118 sends a set control channel parametersmessage 670 to femto cell 114, which prompts femto cell 114 to send aaccess parameter message 672 to mobile node 110. Mobile node sends aregistration message 676 to femto cell 114 with information such asRANDC, AUTHR, and COUNT. Femto cell 114 sends a location update requestmessage 678 including this information to gateway 118. Gateway 118performs interworking on the message and changes the message to a SIPregistration message 680, which is sent to convergence server 562. Theconvergence server 562 sends authorization request to HLR/AuC/HSS 614. ASIP 100 trying message 684 is sent from the convergence server 562 tothe gateway 118. The HLR/AuC/HSS 614 sends an authentication accessaccept message 686 back to the convergence server 562. Convergenceserver 562 sends a registration notification (regnot) message 688 toHLR/AuC/HSS and receives a regnot access accept message 690 back.Convergence server 562 sends a SIP 200 OK message 692 to gateway 118,which triggers interworking at the gateway and a sending of a locationupdate accept message 694 to femto cell 114. A SIP acknowledgementmessage 696 is sent to convergence server 562. Femto cell 114 sends aregistration accept order 698 to mobile node 110. In 700, mobile nodeauthentication is complete.

FIG. 23 illustrates registration of a mobile node through a convergenceserver in accordance with certain embodiments. FIG. 23 includes a mobilenode 110, a femto cell 114, a broadband network 116, a gateway 118including a femto gateway functionality 118, a convergence server 562, aHLR/AuC/HSS 614, and media gateway control function (MGCF)/media gateway(MGW) 564. As shown, an IPSec tunnel is setup 704 between mobile node110 and gateway 118, which provides secure communications between thedevices. Femto cell 114 sends a channel negotiation message 706 tomobile node 110 and the mobile node 110 sends a registration message 708back to femto cell 114. This triggers an update request to register themobile node with HLR/AuC/HSS 614 as described in connection with FIG.22.

FIG. 24 illustrates setup of a voice path through a convergence serverin accordance with some embodiments. FIG. 24 includes a mobile node 110,a femto cell 114, a broadband network 116, a gateway 118 including afemto gateway functionality 118, a convergence server 562, a HLR/AuC/HSS614, and media gateway control function (MGCF)/media gateway (MGW) 564.The convergence server, HLR, and MGCF/MGW can be included in the NGNsoft MSC core in some embodiments. As shown in the signaling diagram ofFIG. 24, the femto gateway can convert direct transfer application part(DTAP)/base station management application part (BSMAP) to SIPmessaging. The femto gateway can also aggregate two or more femto cellshiding the femto cells from the core network as part of the interworkingthe femto gateway provides.

In FIG. 24, a voice call is being setup from a phone that is attached tothe network via a femto cell 114. An IPSec tunnel is already setupbetween mobile node 110 and gateway 118 and the mobile node isregistered with the network as well. When a voice call is going to beplaced from mobile node 110, channel negotiation/setup messaging 710begins between femto cell 114 and mobile node 110. Femto cell 114 alsosends a service request message 712 to gateway 118 to setup a voicepath. Gateway 118 provides interworking from DTAP/BSMAP to SIP messagingand sends SIP invite 714 to the convergence server 562. The convergenceserver 562 sends a SIP invite message 716 to the MGCF/MGW 564. A SIPringing message 718 is sent from the MGCF/MGW 564 which can provideinformation to setup the voice path, e.g., assignment information. Thegateway 118 receives SIP ringing message 720 and provides interworkingto change the message to an assignment request message 722 which is sentto femto cell 114. The femto cell uses this information in setting upthe service connection to the mobile node 110. An assignment completemessage 724 is sent from the femto cell 114 to indicate when the processis complete. A ringback tone is sent from the mobile node 110 in 726 anda voice path between the mobile node 110 and the MGCF/MGW is setup in728.

FIG. 25 illustrates a network architecture for a UMTS based networkfemtocell implementation in accordance with certain embodiments. FIG. 25includes mobile nodes 110 a, 110 b, 110 c, and 110 d, a UTMS capablefemto cell 114, a home gateway 120, a broadband network 152, an internet154, a gateway 118 implementing various functions, a policy and chargingrules function 570, a serving gateway support node (SGSN) 750, a gatewayGPRS support node (GGSN) 752, a charging gateway function 754, a homenodeB gateway manager 756, a home nodeB manager 758 a mobile dataservices server 760, a radio network controller 762, a nodeB 764, an AAAserver 312, a HLR 614, and a MSC/VLR 616. The gateway 118 provides afemto gateway functionality which provides network connectivity of thefemto cell 114 or home NodeB (HNB) to the core network. The gateway 118appears as a legacy radio network controller (RNC) to the core network(using existing Iu interfaces for core network connectivity) andconnects the femto cell 114 using the Iu-h interface. Functionalities,such as the management of the legacy UTRAN identifiers (LAI, SAI,RND-Id, etc) towards the core network, and Iu-h interface management,are performed by gateway 118.

The femto cell 114 acting as a HNB can provide a standard radiointerface (Uu) for mobile node connectivity. Femto cell 114 uses theIu-h interface over un-trusted IP networks to provide access to the corenetwork through gateway 118. Femto cell 114 supports both the BTS andRNC like functions in a low cost plug-n-play form factor. The femto cell114 can also support GSM based mobile nodes. The functionality providedby gateway 118 can also be split to allow other network devices toprovide the functionality such as management of the femto cell or otherservices. The femto cell manager 758 can be provided for management ofthe gateway and femto cell using the Iu-hm reference point tocommunicate with the femto cell via the gateway. In other embodiments,this functionality is provided in the gateway 118. The Iu-hm referencepoint can use existing device management techniques as described in DSLForum technical specifications TR-069, in some embodiments. Also asshown, gateway 118 can communicate with many different network devices.For example, gateway 118 can provide access to the circuit switchednetwork through the IuCS interface, can provide access to the packetswitched network through the Iu-PS, and can communicate with a GGSN 752through the Gn′ interface.

FIG. 26 illustrates a functional view of an integrated gateway thatprovides femto services in accordance with some embodiments. FIG. 26includes a mobile node 110, a femto cell (FC) 114, a broadband network116, a gateway 118 that provides many functionalities, a call sessioncontrol function (CSCF) 778, a mobile switching center (MSC) 780, an AAAserver 312, a SGSN 750, a GGSN 752, a HLR 614, a serving mobile locationcenter (SMLC) 782, cell broadcast center (CBC) 784, femto cell manager786, and element management system (EMS) 788. The gateway provides anumber of functionalities including a security gateway (SeGW) 190, aproxy-call session control function (P-CSCF)/border gateway function(BCF) 770, a IuH Proxy 772, a SGSN function 774, and a GGSN function776. The P-CSCF/BGF 770, IuH proxy 772, SGSN function 774, and GGSNfunction 776 can act as proxies for the femto cells by aggregatingsignals and communicating on behalf of the femto cells to hide the femtocells from the core network, while performing other functions as well.

The SMLC 782 is either a separate network element or integratedfunctionality in the BSC (Base Station Controller) that contains thefunctionality required to support LCS (LoCation Services). The SMLC 782can manage the overall co-ordination and scheduling of resources neededfor the location of a mobile. It also calculates the final locationestimate and estimates the achieved accuracy. The SMLC 782 may controlone or more LMU (Location Measurement Unit) for the purpose of obtainingradio interface measurements to locate or help locate the mobile nodesubscribers in the area that it serves. The CBC 784 is the functionalentity within the network that is responsible for the generation of cellbroadcast information. The Starent Web Element Management System, or EMS788, is a centralized service and network element managementfunctionality that can controls the multimedia core platforms in agateway. Starent Web EMS is a multi-service element manager, whichprovides fault, configuration, accounting, performance and securityfunctions through a graphical user interface. Starent Web EMS enablesmobile operators to monitor, manage and control the performance of theST16 and ST40, as well as integrate and interoperate with othercomponents and network management systems. The Starent Web EMS alsoprovides a variety of performance and operation records based on mobileoperator defined parameters.

FIG. 27 illustrates a functional view of a gateway that provides femtoservices using a controller function in accordance with certainembodiments. FIG. 27 includes a mobile node 110, a femto cell (FC) 114,a broadband network 116, a gateway 118 that provides manyfunctionalities, a home public land mobile network (HPLMN)/visitedpublic land mobile network (VPLMN) 806, a mobile switching center (MSC)780, a proxy AAA server 810, a SGSN 750, a HLR 614, location services782, cell broadcast services 784, femto cell manager 756, and femtogateway manager 758. Gateway 118 can provide functionalities such asgeneric access controller gateway (GAN-GW) signaling gateway and circuitswitched user plane function 802, security gateway 190, and GANcontroller function 804. The basis of the architecture of the FIG. 27 isa functional architecture utilizing generic access network (GAN) Iuinterface mode. In this embodiments, the femto cell providing HNB (homeNodeB) services is responsible for the radio aspects and the gateway 118is responsible for CN (core network) connectivity. Further, the femtogateway is decomposed into two functional elements, where the GANGateway (GAN-GW) 802 provides Security Gateway Function 190 and CS/PSBearer Function 802, and a GAN Controller (GAN-C) 804 provides CS/PS(circuit switch/packet switch) control function.

The architecture of FIG. 27 provides co-existence with the UMTSTerrestrial Radio Access Network (UTRAN) and interconnection with theCore Network (CN) via the standardized interfaces defined for UTRAN: aIu-cs interface for circuit switched services, Iu-ps interface forpacket switched services, Iu-pc interface for supporting locationservices, and Iu-bc interface for supporting cell broadcast services.The femto cell implementing a HNB provides a standard radio interface(Uu) for mobile node connectivity and provides the radio access networkconnectivity to the mobile node using the GAN Iu mode Up interface asdefined in TS 43.318, which is incorporated by reference herein. Thegateway utilizes a Generic Access Network Controller (GAN-C) defined forGAN Iu operation. The functionality of the GAN-C defined for GAN Iuoperation is modified to allow a the HNB (as opposed to a dual modemobile node) to be connected over the generic IP access network.

The gateway provides interworking between the Iu interfaces and the GANIu mode Up interface using the following control plane and user planefunctionality. The gateway provides security gateway function 190 forthe set-up of a secure IPSec tunnel to the femto cell for mutualauthentication, encryption and data integrity, and a SEGW EncapsulatingSecurity Payload (ESP) processing of Up interface control plane packets.The gateway and GAN controller 804 can provide GAN Discovery support andDefault gateway assignment. The GAN-C 804 can provide GAN Registrationsupport including provision of GAN system information to the femto celland possible redirection to a different gateway (e.g., Serving HNB-GW),management of GAN bearer paths for CS and PS services, including theestablishment, administration, and release of control and user planebearers between through the interworking of Up and IuCS/PS control plane(e.g. RANAP), support for paging and handover procedures, andtransparent transfer of L3 messages (i.e., NAS protocols) between themobile node and core network.

In the user plane functionality, the gateway can provide EncapsulatingSecurity Payload (ESP) processing of Up interface user plane packets,interworking of CS bearers between the Up interface (RTP/AMR) and theIu-CS user plane interface Iu-UP, and interworking of packet switcheduser data between the Up interface and the Iu-PS interface (GTP-U). GANGateway 800 can also provide interworking between RTP/UDP and the CSbearers over the Iu-CS interface which supports either ATM (AAL2) or IP(RTP) transport. This inter-working is controlled by the GAN-Controller804 via H.248.1 protocol and relevant packages.

As shown in FIG. 27, transaction control (e.g. CC, SM) and user servicesare provided by the core network (e.g. MSC/VLR and the SGSN/GGSN),however in some embodiments, as shown in FIG. 26, these features can beprovided by the gateway in an integrated fashion. AAA server 810 is usedto authenticate the femto cell when it sets up a secure tunnel and theWm interface can be used for these communications. The femto cellmanagement system (HNB mngmt. System) 756 manages the configuration offemto cells in a scalable manner and can be channeled via the Upinterface's secure tunnel.

The GAN operation is modified to support an interface between the HNBfemto cell and the gateway. For example, the GA-RC REGISTER REQUESTmessage is modified with an additional IE to include HNB femto cellidentity (e.g. IMSI). The GAN Classmark IE is updated with additionaldevice types for femto cell/femto cell-MN and also an Emergency Callrequest flag (for unauthorized MN emergency call registration). The RABConfiguration attribute in GA-RRC ACTIVATE CHANNEL and GA-RRC ACTIVATECHANNEL ACK message is extended to transparently relay radio attributesbetween HNB femto cell and CN via the gateway. The GA-RRC RELOCATIONINFORMATION message is extended to relay radio attributes between HNBfemto cell and the gateway. The GA-RRC SECURITY MODE COMMAND is extendedto include CK, IK so that the HNB femto cell can protect the airinterface. Additionally, the use of a single IPSEC tunnel between HNBfemto cell and gateway for multiplexing separate mobile node sessions isprovided.

FIG. 28 illustrates a functional view of a gateway that provides femtoservices using a controller function and a Iu-H interface in accordancewith certain embodiments. FIG. 28 includes a mobile node 110, a femtocell (FC) 114, a broadband network 116, a gateway 118 that provides manyfunctionalities, a home public land mobile network (HPLMN)/visitedpublic land mobile network (VPLMN) 806, a mobile switching center (MSC)780, a proxy AAA server 810, a SGSN 750, a HLR 614, location services782, cell broadcast services 784, femto cell manager 756, and femtogateway manager 758. Gateway 118 can provide functionalities such asgeneric access controller gateway (GAN-GW) function 802, securitygateway 190, GAN controller function 804, CS bearer function 820, and PSbearer function 822. In FIG. 28 a Iu-H interface is used between femtocell 114 and gateway 118 along with the GAN controller. Additionally, acircuit switched (CS) bearer function is provided for handling CS bearertraffic to the core network and a packet switched (PS) bearer functionis provided for handling PS bearer traffic to the core network. The GANcontroller functions in the way described above with reference to FIG.27 and gateway 118 interacts with the core network (HPLMN/VPLMN) in asimilar fashion.

In some embodiments, a gateway discovery mechanism is provided. Thegateway discovery mechanism provides an automatic way for the gatewayand femto cell to determine the most appropriate serving gateway toprovide femto gateway services in the HPLMN of the femto cell. Theserving gateway is the gateway handling a particular femto cell. Thediscovery mechanism accounts for parameters such as the femto cellidentity and location. The gateway discovery service is one of thefunctions provided by all or a subset of the gateways in the serviceprovider network. Both the gateway and femto cell can be pre-configuredwith the network address associated with the gateway discovery service(e.g., an FQDN that is DNS-resolved to the IP address of one of thegateways providing gateway discovery services). It is also possible toderive the gateway discovery service network address using the femtocell credentials such as the IMSI or other information, in someembodiments.

FIG. 29 illustrates femto cell discovery when the femto cell has nostored gateway address and performs a gateway discovery procedure inaccordance with some embodiments. FIG. 29 includes a femto cell 114, apublic DNS 930, and a gateway 118. In messaging 1, the femto cell 114may derive a FQDN of the gateway discovery service, and perform a DNSquery (via the generic IP access network interface) to resolve the FQDNto an IP address. In messaging 2, the DNS Server returns a responseincluding the IP Address of a gateway that provides gateway discoveryservice. Alternatively, if the femto cell 114 already has the IP addressfor the gateway discovery service, the messaging 1 and 2 may be omitted.In step 3, the femto cell establishes a secure tunnel to the gatewayutilizing IPsec. In messaging 4, the femto cell sets up a reliabletransport session to a port on the gateway. If a GAN interface is used,the transport session is TCP and if IuH is used, SCTP is the transportsession protocol. In messaging 5, the femto cell queries the gatewaywith the discovery service for the address of the serving gateway, usingthe DISCOVERY REQUEST message. There are differences between Up and IuHinterface embodiments. In the IuH interface, the femto cell provideslocation information via use of one or more of the followingmechanisms: 1) detected macro coverage information (e.g. GERAN or UTRANcell information), 2) geographical co-ordinates (e.g. via use of GPS,etc), 3) Internet connectivity information (e.g. IP address or DSL LineIdentifier). It is possible that none of the aforementioned informationis available, so the discovery mechanism supports femto cell assignmentto a default gateway for such cases. Alternately, discovery of servinggateway can be denied until valid location information is provided. Inmessaging 6, the gateway returns the DISCOVERY ACCEPT message, using theinformation provided by the femto cell to determine the address of themost appropriate serving gateway. The DISCOVERY ACCEPT message may alsoindicate whether the serving gateway address information is stored bythe femto cell for future access (i.e., versus performing gatewaydiscovery each time the femto cell is power-cycled). Alternatively, ifthe gateway cannot accept the DISCOVERY REQUEST message in messaging 7,the gateway returns a DISCOVERY REJECT message indicating the rejectcause. In messaging 8, the secure tunnel to the gateway is released.

After the femto cell determines the serving gateway to establish a femtosession with, the femto cell attempts to register with that servinggateway. Registration can inform the serving gateway that a femto cellis now connected and is available at a particular IP address when theinterface IuH is used between the femto cell and the gateway. If GAN-Iuis used, then the femto cell can inform the GAN-Controller of theserving gateway. The serving gateway or GAN-Controller provides thefemto cell with the network operating parameters (such as LAI, RNC-Id,network operating mode, etc) associated with the femto cell service atthe current location which is coordinated between the femto cell andserving gateway. The femto cell utilizes the information to transmitthese network operating parameters to the mobile node as part of theSystem Information Broadcast. This allows the access network to providea network based service access control (SAC) (e.g., femto cellrestriction and location verification). It also provides a mechanism toredirect the femto cell to a different serving gateway (e.g. based onincoming location, current load on the gateway, etc).

FIG. 30 illustrates a femto cell registering with a serving gateway andobtains network operating parameters based on a specific location andspecific serving gateway in accordance with certain embodiments. FIG. 30includes a femto cell 114, a public DNS 930, and a gateway 118. Inmessaging 1, if the femto cell 114 does not have stored information onthe serving gateway 118, it performs the gateway discovery procedure asdescribed with reference to FIG. 29. In messaging 2, the femto cell 114establishes a secure tunnel to the serving gateway 118. This step may beomitted if a secure tunnel is being reused from an earlier discovery orregistration procedure. In messaging 3, the femto sets up a reliabletransport session (TCP or SCTP connection) to a well-defined port on theserving gateway 118. The femto cell 114 then attempts to register withthe serving gateway using a REGISTRATION REQUEST message. The messageincludes registration type, location information, and femto cellidentity. The registration type indicates the end device beingregistered. The location information indicates physical location and canprovide the information using one of the following mechanisms: detectedmacro coverage information, geographical co-ordinates, internetconnectivity information. The femto cell 114 identity is, for example,the IMSI of the (U)SIM associated with the femto cell. In messaging 5,the gateway may use the information from the REGISTER REQUEST message toperform access control of the femto cell (e.g. whether a particularfemto cell is allowed to operate in a given location, etc). If thegateway accepts the registration attempt it shall respond with aREGISTER ACCEPT message and includes the necessary system informationfor the femto cell functionality (e.g. Location Area information,network operation mode, etc). In messaging 6, the gateway may reject therequest (e.g. due to network congestion, blacklisted HNB, unauthorizedlocation, etc). In this case, it shall respond with a REGISTER REJECTindicating the reject cause. Alternatively, in messaging 7, if thegateway is going to redirect the fento cell to (another) serving gateway(not shown), it responds with a REGISTER REDIRECT message to provideinformation about the target gateway. In messaging 8, the femto cell 114releases the transport session as well as the secure tunnel if it doesnot receive a REGISTER ACCEPT message in response.

Registration of the mobile node to a serving gateway by a femto cellserves the following purposes. It informs the gateway that a mobile nodeis now connected through a particular femto cell and is available at aparticular IP address. The gateway keeps track of this information forthe purposes of “directed paging” (e.g. for mobile-terminated calls).Registration of the mobile node allows the gateway to provide networkbased service access control (SAC) functionality. The gateway providesauthorization and enforcement based on the operator's service accesscontrol polices. Network based SAC can be used to insure that aparticular mobile node is indeed authorized service over a particularfemto cell. It allows the gateway to provide mobile node specificservice parameters to the femto cell (e.g. differentiated billing forhome users versus guest users). Registration of the mobile node providesa mechanism for indicating emergency service. With this explicitindication, the gateway can override the normal service access controlsfor this mobile node but the gateway may still restrict the mobile nodeto only emergency services for fraud prevention. In addition, thisemergency services indicator allows the gateway to support emergencycall-backs by targeting the correct femto cell over which the emergencycall originated.

FIG. 31 illustrates a registration of a mobile node in accordance withcertain embodiments. FIG. 31 includes a mobile node 110, a femto cell114, a serving gateway 118, and a core network. The registration can betriggered when the mobile node attempts to access the femto cell thefirst time with an initial NAS (network access server) message (i.e.,Location Update Request). In messaging 1, the mobile node 110 initiatesa LU (location update) procedure by establishing an RRC (radio resourcecontrol) connection with the femto cell (it is assumed that the femtocell has a location area that is distinct from its neighboring femtocell and macro cells to trigger an initial message upon camping on thefemto cell). The mobile node then transmits a NAS message carrying theLocation Updating Request message with some form of identity(IMSI/TMSI). The femto cell requests the IMSI (or other identityinformation) of the mobile node in an identity request message. (Note:For networks supporting network mode 1, the mobile node could trigger acombined Routing Area and Location Area update request instead of theinitial LU request). The femto cell may also optionally perform localaccess control for faster rejection of those mobile nodes not authorizedto access the particular femto cell. Unauthorized mobile node arepermitted registration with the gateway.

In messaging 2, the femto cell establishes a separate reliable transportsession (e.g. TCP or SCTP connection) for each mobile node. In messaging3, the femto cell attempts to register the mobile node 110 on theserving gateway 118 over the mobile node specific transport session bytransmitting the REGISTER REQUEST. The message can include registrationtype, mobile node identity, and femto cell identity. In messaging 4, theserving gateway 118 may perform access control for the particular mobilenode attempting to utilize the specific femto cell. If the servinggateway accepts the registration attempt it responds with a REGISTERACCEPT message back to the femto cell. In messaging 5, the femto celldoes a NAS relay of the Location Updating Request message from themobile node to the serving gateway 118 via the mobile node transportsession established in messaging 2. In messaging 6, the serving gateway118 establishes a SCCP connection to the core network and forwards theLocation Update request (or the combined RA/LA update request) NAS PDUto the core network using the RANAP Initial UE Message. Subsequent NASmessages between the mobile node and core network are sent between theserving gateway 118 and core network using the RANAP Direct Transfermessage. In messaging 7, the core network authenticates the mobile nodeusing standard authentication procedures. The core network alsoinitiates the Security Mode Control procedure. The NAS messages arerelayed transparently by the serving gateway 118 and femto cell 114between the mobile node and the core network. In messaging 8, the corenetwork indicates it has received the location update and it will acceptthe location update using the Location Update Accept message to theserving gateway 118. In messaging 9, the serving gateway 118 relays theLU accept NAS message to the femto cell. In messaging 10, the femto cell114 relays the LU accept message over the air interface to the mobilenode.

FIG. 32 illustrates a decomposed architecture where one gateway acts asa security gateway and another gateway implements a femto gateway inaccordance with certain embodiments. FIG. 32 includes a mobile node 110,a femto cell 114, a broadband network 116, a gateway implementing asecurity gateway 950, an auto-configuration server (ACS) 952, an ATM orIP backbone network 954, a gateway implementing a femto gateway 956, aMSC 780, a SGSN/PDSN/HA 958, a circuit switched domain 130, and a packetswitched domain 132. The security gateway 950 can provide securecommunications over an un-secure broadband network. In some embodiments,an ACS 952 is used to auto-configure the femto cell when plugged in. TheACS 952 can utilize TR-069 to setup femto cells connected to the networkand can provide plug-in-play capabilities. The ACS can enforce locationand direct the femto cell to the appropriate gateway (such as gateway956). In other embodiments, as mentioned above, this functionality canbe handled by a gateway. The femto gateway 956 can provide connectivityto the CS domain 130 through MSC 780 and the PS domain 132 throughSGSN/PDSN/HA 958. The decomposed architecture of FIG. 32 can beimplemented with two gateways with only some functionalities enabled ineach gateway device to implement the decomposed architecture.

FIG. 33 illustrates a security gateway architecture in communicationwith an IMS domain in accordance with certain embodiments. FIG. 33includes a mobile node 110, a femto cell 114, a broadband network 116, agateway implementing a security gateway 950, an auto-configurationserver (ACS) 952, an ATM or IP backbone network 954, a call sessioncontrol function (CSCF) 960, a GGSN/HA 962, a PS domain 132, an IMSdomain 964, a convergence server 562, and a MSC 780. The securitygateway 950 can communicate with a CSCF 960, which can be implemented ina gateway, and establish connectivity to the IMS domain 964. Aconvergence server 562, which can also be implemented in a gateway, canestablish connectivity with various network devices such as MSC 780. Thesecurity gateway 950 can also communicate with a GGSN/HA 962 toestablish connectivity to a PS domain. A gateway, which provides variousfunctionalities such as a security gateway 950, can also implement aSGSN or a PDSN functionality to allow connectivity directly to a GGSN/HA962.

FIG. 34 illustrates another femto based architecture that supportslegacy GSM networks in accordance with certain embodiments. FIG. 34includes mobile node 110, femto cell 114, home gateway 120, gateway 118,internet 970, web server 972, SGSN 782, HSS 614, and legacy GGSN 752. Asecure tunnel is established between femto cell 114 and gateway 118,which allows communications from mobile node 110 to the mobile operatorand the internet 970. The gateway 118 can direct packet switched (PS)traffic to internet 970 and web server 972. The gateway 118 can alsodirect call session traffic to the mobile operator's PLMN and provideregistration of the mobile node.

The challenges inherent in using packet networks for interactive voicecommunications arise from the real-time characteristics of speech. Thethree most important factors that affect speech quality are packet loss,delay, and jitter. The very nature of public infrastructure such as theInternet implies that the level of packet loss and the amount of delayand jitter vary greatly with the network, location, and time. Packetlosses can create gaps in the voice communication resulting in clicksand muted or unintelligible speech. Packet loss may be caused by severalsources. For example, a router may intentionally discard a packetbecause it was damaged during transmission or timed out of a queue dueto congestion problems. Congestion can also contribute to latency andjitter, which can make two-way voice conversation difficult. Such QoSproblems inherent to voice-over-Internet, can be improved by providingrobustness to packet loss, delay, and jitter at the edge devices in thefemto cell and gateway. Some functionalities provided by the femto celland gateway to provide QoS are providing a payload format supportingtransmission of multiple channels, multiple frames per payload, and useof fast codec. Error correction codes (e.g., forward error correction(FEC), RTP redundancy, and frame inter-leaving) implemented by the femtocell and gateway can provide robustness against packet loss. Unequalerror protection and detection (UEP and UED) can be used to providerobustness against bit errors over IP networks.

In some embodiments, the consumer broadband connection may have alimitation on the uplink bandwidth that it can support, which canrestrict the number of simultaneous mobile nodes communicating throughthe secure tunnel. This can be solved by multiplexing multiple mobilenode sessions over the same secure tunnel by transporting severalRTP/NbFP/codec payloads of different user plane connections within onepacket. The multiplexing can occur with packets of the same destinationaddress and DiffServ class. Additional bandwidth reduction can beaccomplished by supporting RTP header compression. Another option is toattempt to hand-out voice calls that are not supported by uplinkrestrictions to other suitable neighboring cells (i.e., other macro orfemto cells) that are available. The gateway can initiate the hand-outbased on the degradation of the voice quality (e.g., packet loss). Thegateway also supports a policy server interface to control provide QoSpolicies across a population of femto subscribers.

FIG. 35 illustrates a femto architecture that supports long termevolution (LTE) networks in accordance with certain embodiments. FIG. 35includes mobile node 110, femto cell 114, a gateway implementing asecurity gateway and serving gateway 980, a gateway implementing apacket data network gateway (PDN GW)/mobility management entity (MME)982, public land mobile network (PLMN) 984, and Internet 986. Thegateway can implement a serving gateway that is in communication with aPDN GW/MME 982 to provide access to an evolved UMTS terrestrial radioaccess network (E-UTRAN). In this embodiments, femto cell 114 isproviding eNobeB coverage to mobile nodes and providing access to theE-UTRAN over a broadband network. In some embodiments, security gatewaycan provide a secure tunnel to provide connectivity to a serving gatewayfunction over a broadband network 116. Other features provided by agateway, described herein are also available for the gateway providingLTE architecture connectivity.

The gateway described above is implemented in a chassis in someembodiments. This chassis can implement multiple and differentintegrated functionalities. In some embodiments, an access gateway, apacket data serving node (PDSN), a foreign agent (FA), or home agent(HA) can be implemented on a chassis. Other types of functionalities canalso be implemented on a chassis in other embodiments are a GatewayGeneral packet radio service Serving Node (GGSN), a serving GPRS supportnode (SGSN), a packet data inter-working function (PDIF), an accessservice network gateway (ASNGW), a base station, a access network, aUser Plane Entity (UPE), an IP Gateway, an access gateway, a sessioninitiation protocol (SIP) server, a proxy-call session control function(P-CSCF), and an interrogating-call session control function (I-CSCF), aserving gateway (SGW), and a packet data network gateway (PDN GW). Incertain embodiments, one or more of the above-mentioned other types offunctionalities are integrated together or provided by the samefunctionality. For example, an access network can be integrated with aPDSN. A chassis can include a PDSN, a FA, a HA, a GGSN, a PDIF, anASNGW, a UPE, an IP Gateway, an access gateway, or any other applicableaccess interface device. In certain embodiments, a chassis is providedby Starent Networks, Corp. of Tewksbury, Mass. in a ST16 or a ST40multimedia platform.

The features of a chassis that implements a gateway, in accordance withsome embodiments, are further described below. FIG. 36 illustratespositioning of cards in the chassis in accordance with some embodiments.The chassis includes slots for loading application cards 990 and linecards 992. A midplane 994 can be used in the chassis to provideintra-chassis communications, power connections, and transport pathsbetween the various installed cards. The midplane 994 can include busessuch as a switch fabric, a control bus, a system management bus, aredundancy bus, and a time division multiplex (TDM) bus. The switchfabric is an IP-based transport path for user data throughout thechassis implemented by establishing inter-card communications betweenapplication cards and line cards. The control bus interconnects thecontrol and management processors within the chassis. The chassismanagement bus provides management of system functions such as supplyingpower, monitoring temperatures, board status, data path errors, cardresets, and other failover features. The redundancy bus providestransportation of user data and redundancy links in the event ofhardware failures. The TDM bus provides support for voice services onthe system.

The chassis supports at least four types of application cards: a switchprocessor card, a system management card, a packet service card, and apacket accelerator card. The switch processor card serves as acontroller of the chassis and is responsible for such things asinitializing the chassis and loading software configurations onto othercards in the chassis. The packet accelerator card provides packetprocessing and forwarding capabilities. Each packet accelerator card iscapable of supporting multiple contexts. Hardware engines can bedeployed with the card to support parallel distributed processing forcompression, classification traffic scheduling, forwarding, packetfiltering, and statistics compilations. The system management card is asystem control and management card for managing and controlling othercards in the gateway device. The packet services card is a high-speedprocessing card that provides mutli-threaded point-to-point, packet dataprocessing, and context processing capabilities, among other things.

The packet accelerator card performs packet-processing operationsthrough the use of control processors and a network processing unit. Thenetwork processing unit determines packet processing requirements;receives and transmits user data frames to/from various physicalinterfaces; makes IP forwarding decisions; implements packet filtering,flow insertion, deletion, and modification; performs traffic managementand traffic engineering; modifies/adds/strips packet headers; andmanages line card ports and internal packet transportation. The controlprocessors, also located on the packet accelerator card, providepacket-based user service processing. The line cards when loaded in thechassis provide input/output connectivity and can also provideredundancy connections as well.

The operating system software can be based on a Linux software kerneland run specific applications in the chassis such as monitoring tasksand providing protocol stacks. The software allows chassis resources tobe allocated separately for control and data paths. For example, certainpacket accelerator cards can be dedicated to performing routing orsecurity control functions, while other packet accelerator cards arededicated to processing user session traffic. As network requirementschange, hardware resources can be dynamically deployed to meet therequirements in some embodiments. The system can be virtualized tosupport multiple logical instances of services, such as technologyfunctions (e.g., a PDN GW, SGW, PDSN, ASNGW, PDIF, HA, GGSN, or IPSG).

The chassis' software can be divided into a series of tasks that performspecific functions. These tasks communicate with each other as needed toshare control and data information throughout the chassis. A task is asoftware process that performs a specific function related to systemcontrol or session processing. Three types of tasks operate within thechassis in some embodiments: critical tasks, controller tasks, andmanager tasks. The critical tasks control functions that relate to thechassis' ability to process calls such as chassis initialization, errordetection, and recovery tasks. The controller tasks mask the distributednature of the software from the user and perform tasks such as monitorthe state of subordinate manager(s), provide for intra-managercommunication within the same subsystem, and enable inter-subsystemcommunication by communicating with controller(s) belonging to othersubsystems. The manager tasks can control system resources and maintainlogical mappings between system resources.

Individual tasks that run on processors in the application cards can bedivided into subsystems. A subsystem is a software element that eitherperforms a specific task or is a culmination of multiple other tasks. Asingle subsystem can include critical tasks, controller tasks, andmanager tasks. Some of the subsystems that can run on a chassis includea system initiation task subsystem, a high availability task subsystem,a recovery control task subsystem, a shared configuration tasksubsystem, a resource management subsystem, a virtual private networksubsystem, a network processing unit subsystem, a card/slot/portsubsystem, and a session subsystem.

The system initiation task subsystem is responsible for starting a setof initial tasks at system startup and providing individual tasks asneeded. The high availability task subsystem works in conjunction withthe recovery control task subsystem to maintain the operational state ofthe chassis by monitoring the various software and hardware componentsof the chassis. Recovery control task subsystem is responsible forexecuting a recovery action for failures that occur in the chassis andreceives recovery actions from the high availability task subsystem.Shared configuration task subsystem provides the chassis with an abilityto set, retrieve, and receive notification of chassis configurationparameter changes and is responsible for storing configuration data forthe applications running within the chassis. Resource managementsubsystem is responsible for assigning resources (e.g., processor andmemory capabilities) to tasks and for monitoring the task's use of theresources.

Virtual private network (VPN) subsystem manages the administrative andoperational aspects of VPN-related entities in the chassis, whichinclude creating separate VPN contexts, starting IP services within aVPN context, managing IP pools and subscriber IP addresses, anddistributing the IP flow information within a VPN context. In someembodiments, within the chassis, IP operations are done within specificVPN contexts. The network processing unit subsystem is responsible formany of the functions listed above for the network processing unit. Thecard/slot/port subsystem is responsible for coordinating the events thatoccur relating to card activity such as discovery and configuration ofports on newly inserted cards and determining how line cards map toapplication cards. The session subsystem is responsible for processingand monitoring a mobile subscriber's data flows in some embodiments.Session processing tasks for mobile data communications include: A10/A11termination for CDMA networks, GSM tunneling protocol termination forGPRS and/or UMTS networks, asynchronous PPP processing, packetfiltering, packet scheduling, Difserv codepoint marking, statisticsgathering, IP forwarding, and AAA services, for example. Responsibilityfor each of these items can be distributed across subordinate tasks(called managers) to provide for more efficient processing and greaterredundancy. A separate session controller task serves as an integratedcontrol node to regulate and monitor the managers and to communicatewith the other active subsystem. The session subsystem also managesspecialized user data processing such as payload transformation,filtering, statistics collection, policing, and scheduling.

In some embodiments, the software needed for implementing a process or adatabase includes a high level procedural or an object-orientatedlanguage such as C, C++, C#, Java, or Perl. The software may also beimplemented in assembly language if desired. Packet processingimplemented in a chassis can include any processing determined by thecontext. For example, packet processing may involve high-level data linkcontrol (HDLC) framing, header compression, and/or encryption. Incertain embodiments, the software is stored on a storage medium ordevice such as read-only memory (ROM), programmable-read-only memory(PROM), electrically erasable programmable-read-only memory (EEPROM),flash memory, or a magnetic disk that is readable by a general orspecial purpose-processing unit to perform the processes described inthis document.

Although the present invention has been described and illustrated in theforegoing exemplary embodiments, it is understood that the presentdisclosure has been made only by way of example, and that numerouschanges in the details of implementation of the invention may be madewithout departing from the spirit and scope of the invention, which islimited only by the claims which follow.

We claim:
 1. A gateway comprising: a femto gateway functionalityconfigured to establish a link over a broadband network to a femto cell;and a gateway functionality in communication with the femto gatewayfunctionality configured to establish a session for and a link with amobile node and to provide communication between the mobile node and acore network, wherein during a handoff of the mobile node between thefemto cell and a macro cell the gateway configured to recognize thesession previously established for the mobile node and use the sessionin establishing a new connection with the mobile node.
 2. The gateway ofclaim 1, wherein the gateway functionality maintains an IP address forthe mobile node through the handoff.
 3. The gateway of claim 1, whereinthe femto gateway functionality sends a registration reply to the femtocell with information previously used in the session.
 4. The gateway ofclaim 3, wherein the femto gateway functionality reuses point to pointprotocol (PPP) parameters with the femto cell in the handoff.
 5. Thegateway of claim 1, further comprising a proxy functionality configuredto aggregate communications from a plurality of femto cells so theplurality of femto cells are not individually exposed to the corenetwork.
 6. The gateway of claim 1, further comprising a securitygateway functionality configured to provide a secure tunnel thatsupports different protocols between each femto cell and the gateway. 7.The gateway of claim 1, wherein the gateway functionality includes aserving gateway functionality in an evolved packet core (EPC) network.8. A method comprising: establishing a link over a broadband network toa femto cell; establishing a session and a link with a mobile nodeattached to the femto cell; communicating data received from a corenetwork to the mobile node; receiving a request for a new connection forthe mobile node during a handoff from the femto cell; detecting thesession previously established for the mobile node; and establishing thenew connection with the mobile node using the session.
 9. The method ofclaim 8, further comprising maintaining an IP address for the mobilenode through the handoff.
 10. The method of claim 8, further comprisingsending a registration reply to a macro cell with information previouslyused in the session.
 11. The method of claim 10, further comprisingreuses point to point protocol (PPP) parameters with a macro cell in thehandoff.
 12. The method of claim 10, further comprising aggregatingcommunications from a plurality of femto cells so the plurality of femtocells are not individually exposed to the core network.
 13. The methodof claim 10, further comprising establishing, at a femto gateway, asecure tunnel that supports different protocols between each femto celland the femto gateway.
 14. The method of claim 13, wherein IP security(IPSec) with IKE authentication is used to establish the secure tunnel.15. Logic encoded in one or more non-transient computer readable mediumthat when executed performs the steps comprising: establish a link overa broadband network to a femto cell; establish a session and a link witha mobile node attached to the femto cell; communicate data received froma core network to the mobile node; receive a request for a newconnection for the mobile node during a handoff from the femto cell;detect the session previously established for the mobile node; andestablish the new connection with the mobile node using the session. 16.The logic of claim 15, further comprising maintaining an IP address forthe mobile node through the handoff.
 17. The logic of claim 15, furthercomprising sending a registration reply to a macro cell with informationpreviously used in the session.
 18. The logic of claim 17, furthercomprising reuses point to point protocol (PPP) parameters with a macrocell in the handoff.
 19. The logic of claim 15, further comprisingaggregating communications from a plurality of femto cells so theplurality of femto cells are not individually exposed to the corenetwork.
 20. The logic of claim 15, further comprising establishing, ata femto gateway, a secure tunnel that supports different protocolsbetween each femto cell and the femto gateway.